From 4f7fbef35b4d81a1bbe503a772a806f848120734 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Tue, 6 Oct 2026 19:42:52 -0400
Subject: [PATCH] feat(nixos): encapsulate CachyOS kernel configuration

---
 configs/nixos/AGENTS.md                  |  2 ++
 configs/nixos/hosts/neogaia/default.nix  |  3 +--
 configs/nixos/hosts/zeus/default.nix     |  3 +--
 configs/nixos/modules/host.nix           | 21 +++++++--------------
 configs/nixos/modules/kernel/cachyos.nix | 18 ++++++++++++++++++
 5 files changed, 29 insertions(+), 18 deletions(-)
 create mode 100644 configs/nixos/modules/kernel/cachyos.nix

diff --git a/configs/nixos/AGENTS.md b/configs/nixos/AGENTS.md
index 30c58f5..15d032d 100644
--- a/configs/nixos/AGENTS.md
+++ b/configs/nixos/AGENTS.md
@@ -61,3 +61,5 @@
   Do not describe NixOS route choices as public-DNS management.
 - Do not hand-author `hardware-configuration.nix` for a host that has not been generated on that machine.
   Generate it on the target system or live ISO, then stage it before evaluating the flake.
+- Configure the Chaotic Nyx cache only on hosts that select `linuxPackages_cachyos` (currently Neogaia
+  and Zeus), not in the generic host module.
diff --git a/configs/nixos/hosts/neogaia/default.nix b/configs/nixos/hosts/neogaia/default.nix
index ffcdcad..a069dcd 100644
--- a/configs/nixos/hosts/neogaia/default.nix
+++ b/configs/nixos/hosts/neogaia/default.nix
@@ -1,6 +1,5 @@
 {
   inputs,
-  pkgs,
   ...
 }:
 # neogaia — Dell XPS 13 9380 laptop.
@@ -13,7 +12,7 @@
     ./disk.nix
   ];
 
-  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+  modules.kernel.cachyos.enable = true;
 
   # So wifi can be joined from the console.
   networking.networkmanager.enable = true;
diff --git a/configs/nixos/hosts/zeus/default.nix b/configs/nixos/hosts/zeus/default.nix
index 41c4e7b..f1ee3f6 100644
--- a/configs/nixos/hosts/zeus/default.nix
+++ b/configs/nixos/hosts/zeus/default.nix
@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 # zeus — Ryzen desktop with AMD graphics.
@@ -15,7 +14,7 @@
 
   nixpkgs.hostPlatform = "x86_64-linux";
 
-  boot.kernelPackages = pkgs.linuxPackages_cachyos;
+  modules.kernel.cachyos.enable = true;
 
   hardware.graphics = {
     enable = true;
diff --git a/configs/nixos/modules/host.nix b/configs/nixos/modules/host.nix
index 44d97a4..bd75037 100644
--- a/configs/nixos/modules/host.nix
+++ b/configs/nixos/modules/host.nix
@@ -5,20 +5,12 @@
   ...
 }:
 let
-  cfg = config.modules.host; # NOLINT(let_order)
-  inherit (config) user;
   hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
-  passwordSecret = "${user.name}-password";
 in
 {
   options.modules.host.enable = lib.mkEnableOption "physical-host base configuration";
 
-  config = lib.mkIf cfg.enable {
-    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
-    nix.settings.extra-trusted-public-keys = [
-      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
-    ];
-
+  config = lib.mkIf config.modules.host.enable {
     nix.gc.automatic = true;
     nix.gc.dates = "Mon 03:15";
     nix.gc.options = "--delete-older-than 30d";
@@ -47,8 +39,9 @@ in
     sops.gnupg.sshKeyPaths = [ ];
 
     users.mutableUsers = false;
-    sops.secrets.${passwordSecret}.neededForUsers = true;
-    users.users.${user.name}.hashedPasswordFile = config.sops.secrets.${passwordSecret}.path;
+    sops.secrets."${config.user.name}-password".neededForUsers = true;
+    users.users.${config.user.name}.hashedPasswordFile =
+      config.sops.secrets."${config.user.name}-password".path;
 
     security.sudo.extraConfig = ''
       Defaults env_keep += "EDITOR VISUAL"
@@ -57,9 +50,9 @@ in
     home-manager = {
       useGlobalPkgs = true;
       useUserPackages = true;
-      users.${user.name} = {
-        home.username = user.name;
-        home.homeDirectory = "/home/${user.name}";
+      users.${config.user.name} = {
+        home.username = config.user.name;
+        home.homeDirectory = "/home/${config.user.name}";
         home.stateVersion = config.system.stateVersion;
         home.packages = with pkgs; [
           eza
diff --git a/configs/nixos/modules/kernel/cachyos.nix b/configs/nixos/modules/kernel/cachyos.nix
new file mode 100644
index 0000000..b590507
--- /dev/null
+++ b/configs/nixos/modules/kernel/cachyos.nix
@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  options.modules.kernel.cachyos.enable = lib.mkEnableOption "CachyOS kernel";
+
+  config = lib.mkIf config.modules.kernel.cachyos.enable {
+    boot.kernelPackages = pkgs.linuxPackages_cachyos;
+
+    nix.settings.extra-substituters = [ "https://nyx-cache.chaotic.cx/" ];
+    nix.settings.extra-trusted-public-keys = [
+      "nyx-cache.chaotic.cx:dJxTrgMC3V3cFfyIiBQDQorG6k1LsqurH/srpMSq7qk="
+    ];
+  };
+}
-- 
2.47.3